Locate dotDefender Blocked Requests: Linux

When dotDefender blocks a request, an error message similar to the following will appear on the website:

The request has been blocked.

Please contact the site administrator and provide the following Reference ID: D375-37D7-4AE7-C92F.

To determine why the requested action was blocked, perform the following steps:

1. Navigate in a browser to <http://<your_server_hostname/DotDefender>

2. The main interface will look like the below:

3. Clicking View Log for the site will allow you to view the logs for that specific site. If you wish to view all logs for all sites or search across all logs, click the Search Log button.

4. This brings up the screen to search for the Reference ID provided in the error message.  Enter in the reference ID, in this case D375-37D7-4AE7-C92F, in the Reference ID field and click Search. Alternatively, you can view the logs for a specific date and site name/IP address in Apache or search for a source IP address.

5. Returned will be a result of what was blocked.  From there, the server can be configured to whitelist the IP address or disable to rule entirely.